Fine-grained firewall policy enforcement using session app ID and endpoint process ID correlation

A method, comprising:

• receiving, at a network device on an enterprise network, process identification (ID) information from an endpoint (EP) agent executed on an EP device, wherein the process identification information identifies a process that is initiating a network session from the EP device on the enterprise network;
• monitoring network communications associated with the network session at the network device to identify an application identification (APP ID) for the network session;
• and
• performing an action based on a security policy using the process ID information and the APP ID, comprising:
• performing one or more of the following:
• A) determining whether the APP ID is unknown/untrusted;
• and
• in response to a determination that the APP ID is unknown/untrusted:
• performing a first responsive action until the APP ID is determined, wherein the first responsive action corresponds to block/drop, hold/quarantine, log, or throttle the monitored network communications;
• and
• after the APP ID is determined, performing a second response action, wherein the second response action corresponds to allow, block/drop, hold/quarantine, log, or throttle, the first responsive action being different from the second responsive action;
• and/or
• B) determining whether the monitored network communications are associated with a known APP ID;
• and
• in response to a determination that the monitored network communications are associated with a known APP ID:
• determining whether the monitored network communications are associated with a process ID not known to be associated with the known APP ID;
• and
• in response to a determination that the monitored network communications are associated with a process ID not known to be associated with the known APP ID blocking the network communications, wherein an application associated with the process ID is related to web browsing, and wherein a file associated with the known APP ID is not associated with web browsing.

A computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:

• receiving, at a network device on an enterprise network, process identification (ID) information from an endpoint (EP) agent executed on an EP device, wherein the process identification information identifies a process that is initiating a network session from the EP device on the enterprise network;
• monitoring network communications associated with the network session at the network device to identify an application identification (APP ID) for the network session;
• and
• performing an action based on a security policy using the process ID information and the APP ID, comprising:
• performing one or more of the following:
• A) determining whether the APP ID is unknown/untrusted;
• and
• in response to a determination that the APP ID is unknown/untrusted:
• performing a first responsive action until the APP ID is determined, wherein the first responsive action corresponds to block/drop, hold/quarantine, log, or throttle the monitored network communications;
• and
• after the APP ID is determined, perform a second response action, wherein the second response action corresponds to allow, block/drop, hold/quarantine, log, or throttle, the first responsive action being different from the second responsive action;
• and/or
• B) determining whether the monitored network communications are associated with a known APP ID;
• and
• in response to a determination that the monitored network communications are associated with a known APP ID:
• determine whether the monitored network communications are associated with a process ID not known to be associated with the known APP ID;
• and
• in response to a determination that the monitored network communications are associated with a process ID not known to be associated with the known APP ID blocking the network communications, wherein an application associated with the process ID is related to web browsing, and wherein a file associated with the known APP ID is not associated with web browsing.